CVE-2025-48583

CVE-2025-48583

High · published December 8, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
0.6
In the wild
Unconfirmed
What it is

⚡ A sneaky logic error could let attackers execute arbitrary code without breaking a sweat! In BaseBundle.java, privilege escalation is just one mistake away. 🔥 Think of it like a construction site where a builder accidentally leaves a door unlocked — anyone could stroll in and take control without the foreman noticing. That's how this flaw operates, and it could lead to serious consequences! An attacker could gain local elevated privileges, allowing them access to sensitive data or system controls with zero user interaction needed. This could mean unauthorized access to critical functions, putting the entire system at risk!

Put simply

Think of it like a construction site where a builder accidentally leaves a door unlocked — anyone could stroll in and take control without the foreman noticing. That's how this flaw operates, and it could lead to serious consequences! This vulnerability in BaseBundle.java arises from a logic error that permits arbitrary code execution. Because no additional execution privileges are required, any local user can escalate their access level without any intervention from other users.

What to do

An attacker could gain local elevated privileges, allowing them access to sensitive data or system controls with zero user interaction needed. This could mean unauthorized access to critical functions, putting the entire system at risk! To protect your systems, immediately update to the patched version that resolves this issue. Regularly audit your codebase for similar logic errors and implement stringent privilege checks to ensure tighter security. 🛡️ You've got this! By acting now, you'll keep your environment secure and safe. 🚀

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00095 · 0.6th percentile
Published
2025-12-08T22:16Z
Affected products (3)
ProductVersionsFixed in
google/androidall versions—
google/androidall versions—
google/androidall versions—
References (2)
EPSS history
Timeline
  • 08 DEC 16:57Z
    In multiple functions of BaseBundle.java, there is a possible way to execute arbitrary code due to a logic error in the code
    cvelistv5